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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely flled 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 
• Failure to reply v^thin the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

I) ^ Responsive to communication(s) filed on 22 November 2005 . 
2a)n This action is FINAL. 2b)(3 This action is non-final. 

3) 0 Since this application is in condition for allowance except for fomnal matters, prosecution as to the merits is 

closed in accordance with the practice under £xpa/te Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-14.16 and 17 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) S Claim(s) 1-14,16 and 17 is/are rejected, 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: a)^ accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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2. n Certified copies of the priority documents have been received in Application No. . 
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application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



Per Applicant *s Restriction Election 
Claims 1-14, 16 and 17 were elected 
Claims 15 and 18 were non-elected and will not undergo examination. 
Claims 1-14, 16 and 1 7 are pending. 



Drawings & Specification 

1. The proposed drawing and specification corrections filed on 5/23/2005 have been 
accepted by the Examiner. 

Restriction Election 

2. The Office acknowledges the receipt of Applicant's restriction election, filed 1 1/22/2005. 
Applicant elects Group I, claims 1-14, 16 and 17, without traverse. Group EI claims 15 and 18 are 
nonelected and will not undergo examination in the instant examination. Claims 1-14, 16 and 17 
are examined in this instant application. This restriction is made FINAL. 

Response to Arguments 

3. Applicant's arguments, see Remarks pages 6-9, filed on 5/23/2005, with respect to the 
rejections of claims 1, 13, 16 and 17 under 35 U.S.C. 103(a) have been fully considered and are 
persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, 
a new ground(s) of rejection is made in view of Garg et al (US 6,327,677). 
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Claim Rejections - 35 USC § 103 
4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



5. Claims 1. 13, 16 and 17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Mayion ei al (USPN 6,763,380) in view of Garg et al (USPN 6,327,677). 

a. Per claims 1 and 16 (differs only by statutory class), Mayion et al teach a method 
of monitoring an element in a computer network, said method comprising: 

• monitoring a preselected variable relating to said element (Col. 3 Lines 15-39; 
monitors device performance relating to routing data); 

• defining a threshold for the monitored preselected variable (Col. 6 Line 66-Col.7 
Line 3 and Col, 10 Lines 1-32; a threshold baseline is defined); 

• establishing a sliding window in time (Col.3 Lines 15-25, Col.8 Lines 1-26 and 
Col. 1 1 Lines 60-67; a sliding window time period is established with scheduling 
variations); 

• detecting when the time above threshold value exceeds a condition window value 
(Col.4 Lines 11-20, Col.lO Lines 11-32 and Col.l2 Lines 7-14; detecting the time 
threshold-crossing occurs); and 

• in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm (Col. 2 Lines 35-40, Col. 12 Lines 7-3 1 and 
Col. 14 Lines 34-48; alarm is realized by implementing exceptions wherein an 
exception detection module initiates traceroutes once the threshold criteria has 
been exceeded). 
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Yet Mayton et al fail to explicitly teach repeatedly generating a time above 
threshold value, said time above threshold value being a measure of an amount of time during 
which the monitored variable exceeded the threshold during the sliding window of time. 
However, Garg et al teach alarms rules for a network monitoring system that measures the 
amount of time during which a monitored variable exceeds the threshold and generates an alarm 
for such a condition (col.l line 65-col.2 line 1, col.8 lines 57-65, col. 12 lines 20-62). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayton et al with Garg et al for the purpose of 
measuring how long a monitored value exceed the threshold, because it indicates how long the 
condition persisted and the severity of the problem. 

b. Per claims 13 and 17 (differs only by statutory class), Mayton et al teach a 
method of monitoring an element in a computer network, said method comprising: 

• defining a profile for that element, said profile including a plurality of different 
alarm rules, each of said different alarm rules establishing an alarm test for a 
corresponding one or more variables (Col. 3 Line 66-Col.4 Line 9, Col. 6 Line 63- 
CoL7 Line 52 and Col. 10 Line 58-Col. 1 1 Line 19; stored data on the performance 
measurements, configuration data, and routings of each device constitute as 
profiles, wherein test protocols are established specifying the particular exception 
rules); 

• detecting when the alarm test for any one or more of the plurality of different 
alarm rules is met (Col.6 Line 66-Col.7 Line 16, Col.8 Lines 14-65, and Colli 
Lines 6-19; exception conditions are detected based on the test protocol); 

• detecting when the time above threshold value exceeds a condition window value 
(Col.4 Lines 1 1-20, Col. 10 Lines 1 1-32 and Col. 12 Lines 7-14; detecting the time 
threshold-crossing occurs); and 

• in response to detecting when the time above threshold value exceeds said 
condition window, generating an alarm (Col.2 Lines 35-40, Col. 12 Lines 7-31 and 
Col. 14 Lines 34-48; alarm is realized by implementing exceptions wherein an 
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exception detection module initiates traceroutes once the threshold criteria has 
been exceeded). 

Yet Mayton et al fail to explicitly teach repeatedly generating a time above 
threshold value, said time above threshold value being a measure of an amount of time during 
which any one or more of the alarm tests has been met during a preselected prior window of 
time. However, Garg et al teach alarms rules for a network monitoring system that measures the 
amount of time during which a monitored variable exceeds the threshold and generates an alarm 
for such a condition (col.l line 65-col.2 line 1, col. 8 lines 57-65, col. 12 lines 20-62). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayton et al with Garg et al for the purpose of 
measuring how long a monitored value exceed the threshold, because it indicates how long the 
condition persisted and the severity of the problem. 

6, Claims 2-4 and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Mayton et al (USPN 6,763,380) and Garg et al (USPN 6,327,677) in view of Northcott (USPN 
6,098,195). 

a. Per claim 2, Mayton et al and Garg et al teach the method of claim 1 as applied 
above, yet fails to explicitly teach the method of claim 1 further comprising after generating an 
alarm, maintaining the alarm at least as long as the time above threshold value exceeds a clear 
window value. However, Northcott teaches generating an alarm condition when the counters 
exceed the threshold limit and maintaining the alarm as long as the counters are above the 
threshold level (Col.3 Lines 21-30). 
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It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayton et al and Garg et al with Northcott for 
the purpose of asserting an alarm upon the detection of a specific event or condition and 
continuing in the alarm state; because it would provide an indication declaring the status of the 
system's operating functions — whether the exception/fault initiating the alarm has been remedied 
or whether the condition is still occurring. 

b. Claim 14 is substantially equivalent to claim 2, and is therefore rejected under the 
same basis. 

c. Per claim 3, Mayton et al and Garg et al with Northcott teach the method of 
claim 2, Northcott further teaches the method of claim 2 wherein said clear window value is 
equal to said condition window value (Col, 3 Lines 13-25; the time above threshold exceeds a 
clear window value, T time periods, which is also the condition window value that when 
exceeded, generates the alarm). 

d. Per claim 4, Mayton et al and Garg et al with Northcott teach the method of 
claim 3, Mayton et al further teach the method further comprising: 

• monitoring a plurality of variables relating to said element, said preselected 
variable being one of said plurality of variables (Col. 6 Line 66-Col.7 Line 10, 
Col. 7 Line 61 -Col. 8 Line 15 and Col. 8 Lines 23-35; a plurality of parameters are 
monitored); and 

• for each of the plurality of monitored variables, defining a corresponding 
threshold for that other variable, wherein the time above threshold value is a 
measure of an amount of time during which any one or more of the monitored 
variables exceeded its corresponding threshold during the corresponding sliding 
window of time (Col.6 Line 63-Col.7 Line 30, Col.9 Line 42-Col.lO Line 30, 
Col. 10 Line 63-Col.ll Line 19 and Col. 13 Line 62-Col.l4 Line 48; the monitored 
performance variables have corresponding threshold criteria according to the data 
provided in the associated test protocols, thus the monitored variables all 
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experience the performance test measurements, including time exceeding the 
threshold limits). 

7. Claims 5-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over Mayton et al 
(USPN 6,763,380) and Garg et al (USPN 6,327,677) in view of Chandra et al (USPN 
6,397,359). 

a. Per claim 5, Mayton et al and Garg et al teach the method of claim 1 as applied 
above, yet fail to distinctly teach the method of claim 1 wherein the step of defining the threshold 
for the preselected variable comprises: computing an average value for the preseleted variable 
based on values obtained for the preselected variable over a corresponding prior period; defining 
an excursion amount; and setting the threshold equal to a sum of the average value plus the 
excursion amount. However, Chandra et al teach implementing an auto-threshold computation, 
with an excursion amount equal to the product of the Stdev_count and Critical_stdev (or Stdev); 
wherein the auto-threshold value is equal to the sum of the mean plus the excursion amount 
(Col.24 Lines 58-67), 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayton et al and Garg et al with Chandra et al 
for the purpose of enhancing threshold criteria to rely on an additional values instead of just one 
amount; because it would aid in establishing a more intricate monitoring system thereby 
reducing false alarms. It would also allow for the use of more precise condition indicators 
capable of differentiating and expanding alarm states that are based on additional values. 

b. Per claim 6, Mayton et al and Garg et al with Chandra et al teach the method of 
claim 5, Chandra et al further teach the method wherein the corresponding period of time is less 



Application/Control Number: 09/886,61 1 Page 8 

Art Unit: 2141 

than a day (Col.3 Lines 24-32, Coi.8 Lines 14-26, Col. 13 Lines 19-25 and Col. 14 Lines 3-29; the 
time period for active or passive performance testing may be periodic or variable based on the 
schedule and the user's preference). 

c. Claim 7 is substantially similar to claim 6 and is therefore rejected under the 
same basis. 

d. Per claim 8, Chandra et al teach the method of claim 6 wherein the step of 
computing the average comprises computing a mean value for the preselected variable using 
values obtained for that preselected variable for the same hour period of the same day of the 
week for a predetermined number of previous weeks (Col. 24 Lines 29-57; the average can be 
computed using the values collected over a selected time window as an average time trend). 

e. Per claim 9, Chandra et al teach the method of claim 5 wherein the step of 
defining an excursion amount comprises: computing a standard deviation for the preselected 
variable based on values obtained for the preselected variable over a predetermined period of 
time; and setting the excursion amount equal to K times the computed standard deviation, 
wherein K is a positive number (Col.24 Line 61 -Col. 25 Line 8; the standard deviation of the 
performance results in calculated and can be multiplied by Stdev_count, K, which is a user 
configurable value comprising positive numbers). 

f Per claim 10, Chandra et al teach the method of claim 9 wherein the step of 
computing the standard deviation comprises computing the standard deviation using values 
obtained for that preselected variable for the same hour period of the same day of the week for a 
predetermined number of previous weeks (Col.24 Lines 34-57; in the auto-threshold 
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computation, the standard deviation can be calculated using the values for the variables on a 
periodic basis). 

g. Per claim 11, Mayton et al and Garg et al teach the method of claim 1 as applied 
above, yet fail to distinctly teach the method of claim 1 wherein the step of defining the threshold 
for the preselected variable comprises: defining an excursion amount; and setting the threshold 
equal to H less the excursion amount, where H is a positive number. However, Chandra et al 
teach auto-threshold computations which comprise calculating a standard deviation of the results 
and it is well-known that the standard deviation is calculated with a plus-or-minus, +/-, factor; 
thus in the minus condition, the threshold would be equal to a value, H, less the excursion 
amount (CoL24 Line 58-Col.25 Line 19). 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine the teachings of Mayton et al and Garg et al with Chandra et al 
for the purpose of enhancing threshold criteria to rely on an additional value instead of just one 
amount; because it would aid in establishing a more intricate monitoring system thereby render 
more exact measurements by offsetting and weighing the performance results. It would also 
allow for the use of more precise threshold indicators capable of differentiating alarm states and 
determining performance trends and characteristics bases on the additional values. 

h. Claim 12 is substantially similar to claim 9 and is therefore rejected under the 
same basis. 
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Conclusion 

8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure: DeLuca (US 6,889,255), Odhner et al (US 6,862,623), Sweet et al (US 6,836,800), 
Cook et al (US 6,691,256), Garg et al (US 6,453,346). 

9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kristie Shingles whose telephone number is 571-272-3888. The 
examiner can normally be reached on Monday-Friday 8:30-6:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia can be reached on 571-272-3880. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Kristie Shingles 
Examiner 
ArtUnU 2141 
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